EUVD-2026-49145
GHSA-6pjx-3pjc-mrj8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft small zlib-compressed payload
-
DeliverySend to vulnerable Thrift service
-
ExploitTHeaderTransport decompresses without bounds
-
ExecutionServer allocates excessive memory
-
ImpactService degrades or crashes
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Compression ratio limits
|
| Exploitation Conditions | Remote unauthenticated exploitation against Apache Thrift Python services using THeaderTransport with zlib compression enabled (default configuration). No special conditions beyond network accessibility to the service endpoint. |
| Impact | No CVSS vector or EPSS score is provided by NVD, and the vulnerability is not listed in CISA KEV. Based on the advisory, the attack vector is network (AV:N) with low complexity (AC:L) and likely requires no authentication (PR:N) for exposed Thrift services, leading to high availability impact (A:H). The absence of EPSS means exploitation probability in the wild is unquantified; real-world risk is moderate given the simplicity of patching. The risk is primarily from resource exhaustion, not code execution. |
| Exploit ScenarioDerived | An attacker crafts a small zlib-compressed request that decompresses to many gigabytes in memory, sending it to a Python Thrift service endpoint. The service’s THeaderTransport decompresses the payload without bounds, rapidly exhausting memory and crashing the process. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 26, 2026
Denial of service in Apache Thrift 0.x before 0.24.0 allows remote attackers to exhaust server memory via crafted zlib-compressed payloads in the Python THeaderTransport layer. The flaw permits a small compressed request to decompress into an excessively large memory allocation, causing service disruption. No public exploit code or active exploitation is known, and the vulnerability is rated important by the Apache project.
RemediationAI
Upgrade to Apache Thrift 0.24.0, which fixes the unbounded decompression. If immediate upgrade is not feasible, disable tHeaderTransport or zlib compression in Python Thrift services, or enforce request size limits at the application layer. Reference advisory at https://seclists.org/oss-sec/2026/q3/260.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in pypi, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Thrift is a cross-language RPC and serialization framework widely used in distributed systems. The THeaderTransport component in the Python bindings adds a header-based framing layer that optionally compresses payloads using zlib. The vulnerability, stemming from unbounded decompression (CWE-409: Improper Handling of Highly Compressed Data), allows a tiny compressed input to expand to arbitrary size because the Python implementation fails to enforce a maximum decompressed length. This can overwhelm the memory allocation on the server.
Know when Thrift gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote, low complexity, no privileges; unbounded decompression causes high availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3Description PRE-NVD
Blast Radius
ecosystem impact- 4 pypi packages depend on thrift (1 direct, 3 indirect)
Ecosystem-wide dependent count for version 0.24.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
An invalid free in Thrift's table-based serialization can cause the application to crash or potentially result in code e
Heap-based buffer overflow in Apache Thrift C++ THeaderTransport::untransform() allows remote code execution by sending
Improper certificate validation in Apache Thrift c_glib TLS clients allows man-in-the-middle attackers to intercept or t
Apache Thrift C++ library's THeaderTransport::readString() fails to properly validate info-header length, allowing an ou
Denial of service vulnerability in Apache Thrift Rust bindings prior to 0.24.0 allows remote attackers to exhaust memory
Denial of service in Apache Thrift through an integer overflow in the TProtocol::checkReadBytesAvailable() function affe
Denial of service in Apache Thrift Node.js server bindings before 0.24.0 allows remote attackers to exhaust server CPU r
Data amplification vulnerability in Apache Thrift's TZlibTransport allows remote attackers to exhaust server resources b
Denial of service vulnerability in Apache Thrift's TCompactProtocol implementation allows remote attackers to trigger in
Uncontrolled recursion in Apache Thrift Node.js library's skip() function enables remote denial of service via crafted p
TLS hostname verification bypass in Apache Thrift C++ bindings allows man-in-the-middle interception of Thrift RPC commu
Out-of-bounds read vulnerability in Apache Thrift Swift implementation allows remote unauthenticated attackers to trigge
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Exploit-DB